ZDTA key terms

A security model that treats no user, device, or network as inherently trusted; every request is authenticated and authorized from identity and context before access is granted.

Zscaler's cloud platform that sits between users and the internet or private applications, applying security and access policy inline in the cloud rather than backhauling traffic to a data center.

A convergence of cloud-delivered security services, including secure web gateway, cloud access security broker, firewall as a service, and zero trust network access, offered from one platform close to the user.

The practice of granting a user, device, or application only the specific access needed for its task, and only for as long as needed, so a compromise cannot spread.

Splitting an application estate into small, individually protected units so access is granted per application rather than per network, limiting lateral movement after a breach.

The system that authenticates users and issues signed assertions about them, which Zscaler consumes to identify the user and enforce access decisions.

Zscaler's cloud security service that inspects traffic from users to the internet and SaaS, enforcing web, firewall, data protection, and threat policy in the cloud.

A ZIA policy that classifies requested web destinations into categories and cloud applications, then allows, blocks, cautions, or isolates them based on user, location, and time.

ZIA's Layer 3 and Layer 4 filtering that permits or denies traffic by source, destination, port, and protocol, with optional NAT and application-aware rules.

Decrypting outbound encrypted sessions inside the Zscaler cloud so content can be inspected, then re-encrypting before delivery; bypass rules exempt sensitive or certificate-pinned traffic.

Content inspection that identifies sensitive data such as personal information, card numbers, or source code in web, SaaS, and email traffic, then blocks, quarantines, or alerts.

Granular SaaS policy in ZIA that distinguishes sanctioned from unsanctioned applications and restricts specific actions such as upload, download, share, or delete.

An isolated environment where ZIA detonates suspicious files and observes their behavior, blocking unknown malware and returning a verdict before the file reaches the user.

Zscaler's cloud service that gives users per-application access to internal applications without a VPN, connecting users to apps rather than placing users on the network.

A lightweight appliance that opens only outbound connections to the ZPA cloud and relays authorized user sessions to internal applications, so no inbound firewall ports are required.

The ZPA definition of a protected internal application, including its domains or IP addresses, ports, and the server group of connectors that can reach it.

A named collection of application segments used to organize applications and simplify writing access policies at scale.

A logical set of App Connectors that are permitted to reach a defined group of application segments, providing scale and redundancy.

Ordered rules that determine which users or groups may reach which application segments, evaluated with conditions such as identity, device posture, and client type.

A defined set of endpoint checks, such as OS version, domain membership, or required software, that a device must satisfy before ZPA permits access.

A delegated partition inside a ZPA tenant that lets a business unit administer its own application segments, connectors, and policies without seeing the rest of the organization.

Zscaler's cloud service that continuously measures end-user experience across devices, networks, and applications, and pinpoints where performance degrades.

A zero-to-one-hundred rating that combines page-response, DNS, and network latency signals to show how good a user's experience is with a given application.

An on-demand diagnostic that runs DNS, ping, traceroute, and web probes from the device and from the cloud to isolate whether a problem lies in the device, network, or application.

The hop-by-hop route between a user's device and an application, with latency and packet loss at each hop, used to find the segment causing poor performance.

A rule that triggers a notification when a ZDX score or metric crosses a defined threshold for a chosen application, location, or user group.

The endpoint agent installed on user devices that forwards traffic to the nearest Zscaler cloud for policy enforcement and also enables ZPA application access.

Zscaler's DTLS-encrypted tunnel that carries all IP protocols and ports from Client Connector to the cloud, replacing the older per-port forwarding tunnels.

A JavaScript file hosted at a URL that browsers download to decide which proxy, if any, to use for each request, commonly used to steer traffic to Zscaler.

A stateless, unencrypted site-to-site tunnel from a location's router to Zscaler that forwards whole-site traffic into the cloud for inspection.

An encrypted site-to-site tunnel to Zscaler, often configured as the primary path or backup for a location and preferred where traffic must be protected in transit.

A configuration in which the browser or device is pointed directly at a Zscaler proxy host and port, without a PAC file or tunnel.

A ZIA object representing a traffic source, identified by source IP addresses or a tunnel, that determines which policies and settings apply to that traffic.

A Client Connector setting that decides which traffic types are tunneled to ZIA, sent to ZPA, bypassed, or blocked on the device.

A ZIA feature that associates a user's identity with a device IP address for a set period, so users behind NAT can still be identified and policed individually.

An admin portal permission model in which predefined roles, such as super admin, auditor, or read-only, limit what each administrator can view or change.

A tamper-evident record of administrative changes showing who changed which setting, when, and often the before and after values.

Continuous export of ZIA web, firewall, and DLP logs to an external SIEM or storage, either through the Nanolog Streaming Service or cloud log streaming.

Documented programmatic interfaces used to automate configuration, retrieve logs and reports, and integrate Zscaler services with other security and IT tools.